Voice of the DBA

Category: Editorial

  • The Danger of Algorithms

    There is a report that came out recently that shows how you can predict Social  Security numbers, an important piece of identity information in the US. This, according to this C|Net article, could result in massive fraud taking place if someone’s birthday is disclosed.

    So many sites want to get this piece of information from you, often to ping you on your birthday or give you some gift. I’ve always been wary, however, and usually put in April 1 instead of my real birthday. It makes for lots of birthday wishes on that day, but that’s OK. I appreciate the thoughts, even if they are a few months off.

    This does highlight the danger of using an algorithm to generate data. Unfortunately there are plenty of people out there that will maliciously find ways to mis-use data, and if they can guess how you generated the data, they can extrapolate that out to calculate what other data might exist in your system. I know most people that need to generate codes often don’t spend a lot of time ensuring they’ve picked a good method from a security point of view.

    The key here is to keep pieces of information somehow separate, to make it more difficult for a criminal of some sort to perform the extrapolation. That gets harder and harder to do, primarily because of the job many of us do. We gather data into SQL Server and other platforms, and make it easy to put this data together.

    As with many of the problems I see in today’s world, I don’t have a perfect solution to this problem. However I think that many of us handle data insecurely, often comparing actual values when a hash, or digital signature might work instead. I know some of that is because we don’t have great tools for working with digital signatures, but also because it’s a complex process.

    Credit card companies, banks, and other institutions often have complex rules for how they handle and process data. I think this more of their secure methods of handling data should be published and taught so that other companies can better learn how to build more secure applications.

    Steve Jones

  • The Reading Poll

    I’ve written and blogged quite a bit about how much I like reading, and specifically my experiences with the Kindle and e-readers. I started with “Should I Buy a Kindle?” last year, and have continued to update people with my experiences, giving you some thoughts on what I’ve thought about the entire e-reading experience.

    In the past week there have been a few very interesting things happen. First there was the release of a Barnes & Noble based e-reader, which is available on multiple devices (Blackberry, Mac, iPhone, PC) and has a large inventory of books available for it. I’ve tried the reader on the PC, iPhone, and Blackberry, with different experiences on each (blogs coming on the other devices). It’s interesting, and it definitely gives me a choice.

    As I’ve been discussing it with my wife, however, she has different perspectives. She tolerates the Kindle, but doesn’t like the iPhone/Blackberry experience, and says she just wouldn’t read that way. But she also doesn’t read that much in terms of books, maybe 5 or so a year.

    The other big news this past week was Amazon removing content from users’ Kindle devices because of a copyright issue. Apparently a self-service application was used by a publisher to upload George Orwell’s 1984 and Animal Farm to the Amazon system, where it was sold to some people. When Amazon was informed that this publisher did not have rights to sell the book, they removed it from their system, removed it from users’ Kindles, and refunded the sales price. However they didn’t explain why the content was removed.

    So for this Friday’s poll, I wanted to take the temperature from people about a few issues. Actually I have two polls:

    How many books do you read a year? (technical and non-technical)

    How much of a danger to individual rights is an online, wired platform?

    What I’m asking in the first question is to get an idea of how much the audience reads. I know it’s not for everyone, and while I read a lot, it’s mostly fiction. It’s a release, enjoyment factor for me. My total count was about 50, though I blew by that with the Kindle. That device enabled me to read more, and so I was probably on pace for about 70 books with the Kindle. That was a combination of fiction and non-fiction, business type books. I typically in the last few years have only read 3-4 technical books  a year on top of that (I know, shame on me).

    The second question is harder, but I’m wondering how people feel  about sales, ownership, and licensing. It’s easy to look at just music, or reading, but I worry about the broader picture, including software. Artists/publishers/creators should be paid for their work. I think it’s only fair, but I also think that consumers of works have rights as well. We don’t just buy a “license” to the software, book, or movie. If we do, it’s a perpetual license since I don’t think that Microsoft can stop me from running Windows 95 in 2040 just because they don’t support it or want me to upgrade. Likewise I’m not sure that Disney can ever prevent me from watching a VHS tape of Toy Story in 50 years (assuming I have a VCR).

    But that’s what Amazon did, and it’s absolutely a violation of the spirit of business as well as (from what I see) a violation of their terms of service. This has been an issue with TiVO/Dish Network,  and it will continue to be an issue in other cases as there is a connection between the platform and a retailer. My view is that connection is what is best about the Kindle, but it apparently is also the worst thing. If Amazon, or a court, can force actions through this link, it feels like a fundamental violation of the 4th Amendment (in the case of a court).

    Or is it? If you purchased a stolen car (or other good), I think you would have to return the goods. Indeed, as I’ve searched some legal precedents, it appears that’s the case. An old English law posting on Stolen Goods says that when the thief is convicted, the goods must be returned to the original owner. That’s if you were not aware the goods were stolen; if you were, you have violated the law.

    As much as it stinks, if you traffic in stolen goods, or perhaps criminal goods is a better term, you lose out on your purchase price unless you seek restitution from the party who sold the item to you. It seems as though the problems are with digital goods since there doesn’t seem to be a loss of goods from the original owner. There also is a huge distribution channel problem in that one copy of “illegal bits” can be sold to thousands of people.

    Personally I believe that 1984 was chosen specifically because of the topic and to test what might happen. And in my opinion, Amazon failed the test, not because this is not what might have been ordered, but because of the way it was handled. Without a conviction, there is no “search and seizure” allowed. Stolen goods aren’t that until a thief is convicted, or in this case, a copyright violator is determined by a court. And without informing consumers of the reasoning, it feels as though Amazon has violated their trust.

    Steve Jones

    Podcast: http://m.podshow.com/media/16930/episodes/166748/sqlservercentralmp3-166748-07-23-2009.mp3

  • Good Practices for Software Development

    Would you post your password on a wall in your office? Of course not, because other employees, the cleaning crew, even guests walking around your office would be able to access your system with your account. When I read Brian Kelly’s post on passwords in files, that’s what I thought of. Sticking credentials in a file, where they’re subject to any kind of search, is a bad idea.

    However this happens all the time. Combine this with a few other “common practices” like using sa to connect to a database and building dynamic SQL, and you might as well just set blank passwords and invite someone to have fun with your database. It’s sad that we continue to see these types of software development practices in 2014, and especially poor to see them from companies that sell software.

    There is so much information out there on building software that is of higher quality and is much more secure. However all too often I find developers just aren’t implementing these practices. There are probably a myriad of reasons why, and I wish we had more ways to better train people, disseminate the information, and enforce it’s use.

    Ultimately we can only do what we can. However I’d encourage those of you that see poor practices taking place to have a word with the developer (internally), or send a note to the vendor. If it’s more important to make a few more dollars than implement better practices, I’d encourage you to publicly call some attention to the matter. Maybe a little exposure to the dark side of software development will pressure managers to require more secure work over time.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.0MB) podcast or subscribe to the feed at iTunes and LibSyn. feed

    The Voice of the DBA podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

  • Open Source the MCM

    It’s over. There’s no more MCM program or certification from Microsoft. The last MCM test was given last year and no upgrades are planned for SQL Server 2012 or SQL Server 2014. That’s a little sad, though there are quite a few of our SQL Server professionals that can still proudly wear the MCM title for the rest of their careers.

    The MCM tests were designed differently than all the other MCP type tests, requiring more thought and deduction, as well as practical skills. The lab in particular was daunting to many of the MCMs, most of whom would tell you about the difficulties in getting through the scenarios in the limited time alloted. All of the people I’ve talked to found the challenge refreshing and also informative, enabling them to learn a few things about their knowledge, even from the problems they didn’t complete.

    Since that chapter in Microsoft Learning is complete, and the tasks likely out of date, I’d ask that Microsoft Learning release the questions and scenarios to the world as an open source project. Unlike the other certifications and exams, these questions aren’t going to be re-used anytime soon and the knowledge could help many people learn to build better solutions.

    This would be a great move, allowing many DBAs to challenge themselves with the questions and scenarios in practice labs. The types of scenarios could be used in interviews for new employees, either as they are written or modified for a particular environment. Professionals using the SQL Server platform would get an idea of not only the broad level of knowledge that MCMs have, but they’d also have a way to test themselves and direct their own learning to become better rounded SQL Server developers and administrators.

    I doubt it would happen, but I’d think Microsoft could help the community, generate some goodwill, and help improve the overall quality of people working on their platform.

    Update: I have opened a Connect item for this. Please vote

    Podcast: http://traffic.libsyn.com/voiceofthedba/mcmoss_58_v1063.mp3